Search/CVE-2026-20079
● CVE — Critical

CVE-2026-20079

VendorciscoProductsecure firewall management centerDiscoveredMar 4, 2026UpdatedSep 16, 2026

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. 

CVSS v3.1
10 CRITICAL
EPSS
88.5%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
10
sources referencing this CVE
Related IOCs
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 22, 2026
▲ 50.8pp
37.7% → 88.5% over 7 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Connections
17 relationships
Timeline
disclosure → media coverage
Mar 4, 2026
Disclosure — published as a CVE record. · last revised by NVD Sep 16, 2026
Sep 9, 2026
bleepingcomputer.com reports: Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
Sep 10, 2026
securityweek.com reports: Organizations Warned of Cisco Secure FMC Exploitation
Sep 10, 2026
thehackernews.com reports: CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
Sep 10, 2026
helpnetsecurity.com reports: Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)
Sep 11, 2026
thehackernews.com reports: Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Sep 12, 2026
advisories.ncsc.nl reports: NCSC-2026-0076 [1.03] [H/H] Kwetsbaarheden verholpen in Cisco Secure Firewall Management Center
Sep 17, 2026
securityweek.com reports: Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard
Sep 17, 2026
thehackernews.com reports: ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
Sep 23, 2026
bleepingcomputer.com reports: InfraTrust report warns network management systems under attack
Oct 28, 2026
advisories.ncsc.nl reports: NCSC-2026-0458 [1.00] [M/H] Kwetsbaarheden verholpen in Cisco Secure Firewall ASA, Threat Defense en Management Center